Require MFA
Create the supported MSPControl MFA policy for the selected organization and manage its user membership through the configured MSPControl location scope and per-user exclusion state.
Microsoft Entra identity operations
Use MSPControl’s customer-specific Azure Security workflow for supported MFA, legacy-authentication, and identity-risk policies while keeping scope, permissions, licensing, exclusions, and outcomes visible.
MSPControl applies its supported policy settings to one selected customer organization at a time. Tenant licensing, application permissions, user readiness, emergency access, and Microsoft-side verification remain required.
Answer first
For an MSP, Conditional Access management means repeating a controlled identity-access process for separate customer tenants without losing each customer’s licensing, users, exceptions, and resulting Microsoft state. MSPControl supports a defined set of customer-scoped policies; it does not provide a general policy-template engine or a single action that safely changes every tenant at once.
Before changing access
Conditional Access can affect every interactive sign-in in scope. Complete the preparation for the selected customer before the MSPControl setting writes to Microsoft Entra.
Verify the selected MSPControl organization, tenant ID, delegated relationship, responsible technician, and approved change window.
Check the license needed for the intended policy. Risk-based Conditional Access requires Microsoft Entra ID P2 for the users placed in those supported response groups.
A read-only tenant application does not write Conditional Access policies. Confirm the customer connection can perform the intended change before relying on the setting.
Follow Microsoft’s current emergency-access guidance, test the recovery path, and record which accounts or provider identities must remain usable.
Security Defaults and Conditional Access are different operating models. MSPControl blocks its CA or identity-risk save while Security Defaults remains enabled.
Document the intended users, MSPControl organization locations, exclusions, expected sign-in result, verification owner, and Microsoft-side recovery action.
Verified current scope
The released product uses MSPControl-managed groups and fixed policy shapes for specific customer identity outcomes.
Create the supported MSPControl MFA policy for the selected organization and manage its user membership through the configured MSPControl location scope and per-user exclusion state.
Create the supported block-legacy-authentication policy and manage its group membership, location scope, and explicit user exclusions.
For eligible Entra ID P2 users, configure the four supported low-risk and medium/high-risk sign-in or user responses, with separate scope and exclusions.
When the customer tenant application is read-only, MSPControl hides or skips tenant-writing controls instead of presenting a local save as successful CA enforcement.
When an MFA, legacy-authentication, or identity-protection update fails, the Azure Security page reports a warning and points the operator to the audit/task record.
The security-compliance baseline can compare MFA-through-Conditional-Access and block-legacy-authentication state, but it does not automatically correct those controls.
Current boundary: MSPControl does not claim arbitrary Conditional Access policy authoring, policy import from another tenant, identifier translation, bulk deployment to every tenant, report-only state selection, What If simulation, automatic drift remediation, complete policy coverage, automatic rollback, or guaranteed enforcement.
Customer-by-customer operating model
The repeatable part is the operating sequence. Licensing, directory objects, exclusions, identity topology, existing policies, and user readiness stay customer-specific.
Record Security Defaults, existing Conditional Access behavior, supported MSPControl settings, emergency access, exclusions, and the expected Microsoft result.
Use Microsoft’s report-only analysis, What If evaluation, sign-in logs, and pilot guidance where those tools apply. They are Microsoft Entra capabilities, not MSPControl functions.
Select the customer organization and use the exact MFA, legacy-authentication, or identity-risk setting whose current behavior and prerequisites you have reviewed.
Review the returned warning or success state and the MSPControl audit/task output. A saved local setting is not enough when the Microsoft write failed.
Confirm the policy object, group membership, exclusions, and real sign-in outcomes in the customer tenant before increasing the affected scope.
Document the customer result, recovery path, and remaining exception. Repeat the sequence for the next tenant instead of assuming the previous outcome carries over.
Capability map
This map separates released MSPControl behavior from Microsoft-side deployment safety and capabilities that are not promised.
| Operating area | Owner | Current statement |
|---|---|---|
| MFA Conditional Access policy | MSPControl | Supported fixed policy shape for the selected customer organization, with MSPControl-managed group membership. |
| Block legacy authentication policy | MSPControl | Supported fixed policy shape for the selected organization, with location scope and explicit user exclusions. |
| Four identity-risk responses | MSPControl | Supported for eligible Entra ID P2 users: low-risk sign-in MFA, low-risk user password change plus MFA, and medium/high-risk sign-in or user blocking. |
| Security Defaults interlock and read-only gating | MSPControl | MSPControl guards incompatible saves and prevents read-only tenant connections from performing the supported CA writes. |
| Report-only analysis, What If, sign-in logs, emergency access | Microsoft Entra | Use the current Microsoft tools and operating guidance. The page does not rebrand them as MSPControl features. |
| Arbitrary templates, cross-tenant translation, bulk deployment, drift remediation | Not claimed | The current public claim is limited to MSPControl’s defined customer-scoped policies and checks. |
| Block Device Code Flow policy in MSPControl | Not released | The related Work Item was removed, so it is not included in the current supported policy set. |
Common questions
MSPControl lets technicians repeat its supported Conditional Access workflow inside separate customer organizations. Each tenant keeps its own connection, licensing, users, MSPControl location scope, exclusions, policy objects, and resulting Microsoft state. The current product does not provide one universal action that deploys an arbitrary policy to every tenant.
The verified scope covers MSPControl’s defined MFA policy, block-legacy-authentication policy, and four licensed identity-risk responses: low-risk sign-in requires MFA, low-risk user requires password change plus MFA, medium/high-risk sign-in blocks access, and medium/high-risk user blocks access.
No such current capability is claimed. The released policy builders reviewed for this page create their supported policies in Enabled state. Report-only analysis and What If evaluation belong to Microsoft Entra and should be used according to Microsoft’s current guidance where applicable.
The Azure Security page prevents saving its MFA Conditional Access or identity-protection settings while Security Defaults remains enabled. Review Microsoft’s current guidance, licensing, and the replacement protections before changing Security Defaults for a customer.
No. MSPControl hides or skips tenant-writing Azure Security controls for a read-only tenant application. Read-only visibility and local reporting settings do not mean the customer tenant was changed.
No guarantee is made. MSPControl has defined scope and exclusion behavior plus a Security Defaults guard, but emergency-access preparation, customer approval, Microsoft-side evaluation, pilot testing, verification, and recovery remain operator responsibilities.
No. The current baseline can compare supported MFA-through-Conditional-Access and block-legacy-authentication signals, but those controls are not in the baseline’s limited automatic-correction set.
Configuration and verification
Open MSPControl documentation for the released operating surface and Microsoft guidance for Entra licensing, deployment analysis, emergency access, and tenant-side validation.
Self-hosted. Free license available. No credit card required.